Medlock Square Privacy Policy

Medlock Square Privacy Policy
Last updated: 3rd March 2026

Manage your current privacy settings here.

1. What is this policy for?

This privacy policy sets out the way in which Medlock Square may process your personal data. Medlock Square is a trading name of companies within the City Football Group Limited Group.

Medlock Square comprises the following companies:

·       Medlock Holdings (Manchester) Limited

·       Medlock Hotel (Manchester) Limited

·       Medlock Restaurants (Manchester) Limited

·       Medlock Attractions (Manchester) Limited

Medlock Square also has affiliated venues such as the Etihad Stadium (operated by Manchester City Football Club Limited) and the Co-op Live Arena (operated by Eastlands Arena Limited).

For information on how Etihad Stadium may handle your personal data please visit -  https://www.mancity.com/privacy-policy.

For information on how Co-op Live Arena may handle your personal data please visit - https://www.cooplive.com/privacy-policy-hp3z.  

This Privacy Policy explains how Medlock Square collects, uses, shares, and protects your personal information when you visit or interact with any of the venues at Medlock Square, use services, purchase goods, engage digitally, or appear in Medlock Square content capture.

2. Who we are

For the purpose of the Data Protection Act 2018 and the General Data Protection Regulation (“GDPR”), the data controller for Medlock Square is City Football Group Limited (company number: 08355862) whose registered office is at City Football HQ, 400 Ashton New Road, Manchester, England, M11 4TQ

We are registered with the Information Commissioner’s Office (ICO) as a data controller, with reference number ZA234714. You can see our registration here.

3. Personal data we collect about you

We may collect a variety of your personal data. Here is a list of the data we may collect from you:

·       Information you provide to us such as your salutation, first and last name, date of birth, address, email address and contact telephone number

·       Information such as the purchases and bookings you make in Medlock Square and the preferences you set.

·       Information collected on-site, such as CCTV footage, filming, photography, Wi-Fi analytics and venue access logs.

·       Online data such as your IP address, device details, cookies and app usage.

·       Information from other CFG entities and authorised partners.

Special category data that we may collect about you

Special category data is data that attracts an extra level of protection under the data protection law. The types of special category data we may collect about you includes:

·       If you tell us about any disability or health needs (including for example, allergies) when booking an event or service or you are confirming you are in good health for the purpose of some events or services (including for example, where you are required to complete a waiver), we record this so we can make any necessary adjustments and help keep you safe. We’ll normally ask for your consent before doing this, unless the law requires us to use the information for another reason.

·       In rare cases, we may also need to use information about criminal convictions. This would only happen where it’s necessary for public safety or preventing crime, and only with strong protections in place.

4. How and why we use your information

We may use your personal data for a variety of reasons. How and why we may use your personal data is listed below:

·       To deliver the services and experiences you have selected

·       To ensure your safety and security, including CCTV monitoring and incident response.

·       To create relevant content for promotional and entertainment purposes

·       For marketing, personalisation, analytics and communications

·       Data enrichment to improve the accuracy of the personal data we hold about you. We undertake data enrichment to help us check that our data is correct, organised and up to date, and also help us remove any information we no longer need. This allows us to better understand your interests and preferences, so we can share information that’s more relevant to you and improve your experience with our products and services.

·       To collect feedback and reviews to help us improve the services, experiences and products we provide.

·       To ensure we remain compliant with all applicable laws and legislation

·       The prevention of fraud

5. Legal bases for processing

We use your information for a variety of legal bases, including:

• Our legitimate interests - To run and improve our business, operate our website, create and share content (including photos, filming and other production work on our platforms or third-party sites, streaming services or social media), and make sure the content you see is relevant to you.

• Fulfilling a contract with you - When you buy goods or services from us—directly, through a partner, or through one of our group companies—we need to use your information to provide what you’ve purchased.

• Legal obligations - Sometimes we must use your information because the law requires it. This includes areas like health and safety, matchday safety and public order, and managing age restricted content.

• Your consent - For certain activities—such as sending direct marketing—we only use your data if you’ve agreed to it. You can withdraw your consent at any time, but this won’t affect any use of your data before you withdrew it.

If we introduce a new feature or product that needs a separate account, we may create this for you automatically using your existing account details. If we do this, we’ll email you to let you know.

When can we send you marketing, and how can you change your mind?

We may send you updates or direct marketing when you sign up for any of our products or services. We may also contact you with marketing about our products, services, sponsors, promotions, and other activities we think may interest you.

You can opt out at any time by contacting us at [email protected].

6. Sharing your personal information

We may share your information with other companies in the City Football Group, as well as affiliated venues and trusted service providers who help us deliver our products and services. This includes companies that support our website, assist with communications, run prize draws and promotions, or help us keep our data accurate and up to date.

If we take photographs or video recordings for commercial purposes, we may also share these with organisations involved in producing or distributing that content. This can include group companies, co‑producers, distributors, professional advisors, financiers, and others who play a role in the production.

When you make purchases across Medlock Square we share relevant information with our payment providers, merchants, and 3D‑Secure services to help prevent fraud.

In addition, we may share your details with our professional advisors or with a potential buyer if part or all of our business or assets is ever considered for sale. We may also share information with law enforcement.

We may share your information with our business partners, suppliers and subcontractors when it is necessary for a contract we have with them or with you.

We may also share your personal information with third parties in the following situations:

• Buying or selling a business - If we sell or buy a business or assets, we may share your information with the potential buyer or seller.

• If our business is acquired - If City Football Group, or most of their assets, is bought by someone else, customer information may be transferred as part of the sale.

• Legal or safety reasons - We may share your information if we are required to do so by law, by a court or police request, in order to keep our site safe, or to enforce any applicable terms of use/ terms and conditions of purchase.

• We may also share your data to protect the rights, property or safety of City Football Group, our customers or others. This can include sharing information with other organisations for fraud prevention and credit risk reduction.

We may also share your information with certain selected third parties, including:

• Business partners, suppliers and subcontractors who help us deliver services under a contract.

• Advertisers and advertising networks that need data to choose and show relevant adverts to you and other users.

• Analytics and search engine providers who support us in improving and optimising our websites and apps.

Whenever we share your data, we always take reasonable steps to ensure that appropriate safeguards are in place to protect it.

7. International data transfers

Sometimes we may need to transfer your information to countries outside the European Economic Area (EEA). We only do this when there are proper safeguards in place or when the transfer is otherwise permitted by law.

Some of the countries we may transfer data to do not offer the same level of data protection as the UK. To make sure your information remains protected, we must ensure that lawful safeguards are used.

When we transfer your data to a third party outside the EEA (including another company within our group), we will only do so if:

• the country has been formally recognised as providing adequate protection for personal data); or

• we have put in place the European Commission’s approved standard contractual clauses to ensure your data is protected.

We will only transfer your data outside the EEA without these safeguards in very limited situations, such as when:

• you have given us your explicit consent after we’ve explained the risks;

• the transfer is needed to carry out a contract with you, or with a third party acting in your interests; or

• the transfer is necessary to establish, exercise or defend legal claims.

We take the protection of your personal information seriously. We use a range of technical and organisational measures to help keep your data safe and to make sure it is handled in line with this privacy policy.

Your information is stored on secure servers, and we put controls in place to protect the security and integrity of our digital products, services and databases. Only authorised people are allowed to access your data.

When you enter your payment card details, we use secure sockets layer (SSL) encryption technology to help protect your information. However, no data sent over the internet can ever be completely secure, so we cannot guarantee absolute security.

If we give you a password (or you choose one) to access certain parts of our websites or apps, it is your responsibility to keep it safe. Please do not share your password with anyone.

Our websites and apps may contain links to other websites. We are only responsible for our own privacy practices. We recommend checking the privacy and security policies of any external sites you visit.

8. How long we keep your information

We keep your information only for as long as necessary to fulfil the purposes we collected it for. We regularly review the information we hold to make sure we are not keeping anything for longer than needed.

Some of the factors that affect how long we keep information include:

• Legal requirements

• Managing our legal risks

• How we run and manage our business

• Our relationship with you and the services we provide

If you enter into a contract with us (for example, when you buy goods or services), we usually keep your information for six years after the contract ends.

If you would like more details, please contact us.

9. Your rights

Data protection law give you several rights over your personal information. These include the right to:

• Ask for a copy of the information we hold about you

• Ask us to correct or update your data

• Ask us to delete your data or restrict how we use it

• Object to us processing your data (including objecting to direct marketing)

• Ask us to transfer your data to another organisation

• Withdraw your consent where we rely on it

How these rights apply may depend on your specific situation. If you want to exercise any of these rights, please contact us. More detail is set out below.

To contact us about your rights, email [email protected].

Your rights in more detail

You can contact us to exercise these rights. You can also find more information on the ICO’s website: https://www.ico.org.uk

Fees, Identification and Response Times

You do not need to pay to access your data or exercise your rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. In these cases, we may also refuse your request.

We may ask for information to confirm your identity and ensure your data is not shared with anyone who should not have access to it. We may also ask for additional details to help us process your request more quickly.

We aim to respond to all valid requests within one month. If your request is complicated or you have made several requests, it may take longer, but we will keep you updated.

Contacting Us and Complaints

If you have questions, want to exercise your rights, or wish to make a complaint, you can contact our Data Protection Officer at: [email protected]

You also have the right to complain to the Information Commissioner’s Office (ICO):

Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Phone: 0303 123 1113
Website: https://www.ico.org.uk

Information for Children

This is a simpler explanation of how we use information, designed for children. You should read it with a parent or guardian who can help explain anything you’re unsure about.

When you:

• visit our website (including videos and games)

• download one of our apps

• contact us

• create an account

we collect some information about you (like your name or details about the device you’re using).

We collect this information so we can improve our apps, website and services. We only collect the minimum amount of information we need and keep it only for as long as necessary. You can ask us for a copy of your information, or ask us to correct, delete or stop using it. We work hard to keep your information safe.

For some things, we need your permission.

• If you are 13 or over, you can usually give this yourself.

• If you are under 13, we need permission from your parent or guardian.

You can use parts of our websites and apps without giving us any personal information. If you do give us information (like signing up for a newsletter), we use it only for the purpose we told you about.

You can ask us to stop sending messages at any time by using the unsubscribe link or by contacting [email protected]. Parents and guardians are encouraged to supervise their child’s online activity.

We always make sure that any content or marketing aimed at people under 18 is age‑appropriate. If you have any concerns, please contact [email protected].

Updates to This Privacy Policy

If we change how we use your information, we will update this page. We encourage you to check back from time to time to see the latest version. If we make a major change, we will normally contact you to let you know.